API Keys: Generate, Use, and Revoke
API keys let an external tool authenticate as your FlexFiles account without logging in through a browser. This page covers who can use them, how to generate one, and how the authentication model works.
Why use an API key
FlexFiles normally authenticates people through a browser login, which issues a short-lived session token. That works well for a person clicking around the product, but it is not practical for an automation tool like Zapier, or a script, to manage. API keys solve this with a separate credential built for long-lived, machine-to-machine use: generate it once, and it keeps working until you revoke it.
Who can use it
- API access is a plan add-on, not something every account gets automatically.
- An admin enables “API access” on a pricing package from the internal package settings.
- Once enabled on your plan, the API Keys section appears under Account settings.
- If you don't see it, your current plan does not include API access — contact support about upgrading.
Generating a key
- 1
Go to Account → API Keys.
- 2
Click “Generate key”.
- 3
Give it a name that identifies what will use it, such as “Zapier” or “Invoice automation”.
- 4
Copy the key from the dialog that appears. This is the only time the full key is shown.
- 5
Store it in whatever tool will use it (e.g. Zapier's connection setup) — FlexFiles cannot show it to you again.
After you close the “key generated” dialog, FlexFiles only ever displays a masked prefix like ff_JcBtyx…. If you lose the key, revoke it and generate a new one — there is no way to retrieve the original value.
How a key authenticates a request
A generated key is a random secret. FlexFiles stores only a one-way cryptographic hash of it, never the key itself, following the same pattern used for other secret links in the product. When a request arrives with a key, the server hashes the incoming value and looks for a match — if one is found, the request is treated as coming from the account (and workspace) that generated the key, with all of that account's normal permissions and plan limits applying.
- A key is scoped to whichever workspace (personal or organization) was active when it was created.
- Requests made with a key count against the same daily and plan conversion quotas as requests made from the website — there is no separate, unmetered path.
- An account can hold at most 5 active keys at a time.
Revoking a key
Revocation takes effect immediately on the very next request — there is no delay or caching to wait out. Revoke a key as soon as you stop using it, or if you suspect it leaked.
- 1
Go to Account → API Keys.
- 2
Find the key in the table and click “Revoke”.
- 3
Confirm in the prompt.
Common API key questions
Can I see a key's full value again after I close the dialog?
No. FlexFiles never stores the raw key, only a hash of it, so it cannot be redisplayed. Revoke the key and generate a new one if you lose it.
Do API requests use a different quota than the website?
No. Conversions made with an API key count against your plan's normal daily and lifetime conversion limits, visible on your Account page.
What happens to in-progress work if I revoke a key?
The key stops authenticating new requests immediately. It does not retroactively affect files already converted.
Can I have more than one key?
Yes, up to 5 active keys per account — useful for naming one per integration (e.g. one for Zapier, one for an internal script) so you can revoke them independently.